API keys, secrets, and tokens commonly left exposed in browser extensions’ code.